Lucene search

K
debianDebianDEBIAN:DLA-3717-1:48EB5
HistoryJan 24, 2024 - 9:16 p.m.

[SECURITY] [DLA 3717-1] zabbix security update

2024-01-2421:16:11
lists.debian.org
7
ssrf
sensitive information
xss
code execution
zabbix network monitoring
debian 10 buster
system crash
security update

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

7.8 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

39.1%


Debian LTS Advisory DLA-3717-1 [email protected]
https://www.debian.org/lts/security/ Tobias Frost
January 24, 2024 https://wiki.debian.org/LTS

Package : zabbix
Version : 1:4.0.4+dfsg-1+deb10u4
CVE ID : CVE-2023-32721 CVE-2023-32723 CVE-2023-32726
Debian Bug : 1053877

Several security vulnerabilities have been discovered in zabbix, a
network monitoring solution, potentially allowing an attacker to perform
a stored XSS, Server-Side Request Forgery (SSRF), exposure of sensitive
information, a system crash, or arbitrary code execution.

CVE-2023-32721

A stored XSS has been found in the Zabbix web application in the
Maps element if a URL field is set with spaces before URL.

CVE-2023-32723

Inefficient user permission check, as request to LDAP is sent before
user permissions are checked.

CVE-2023-32726

Possible buffer overread from reading DNS responses.

For Debian 10 buster, these problems have been fixed in version
1:4.0.4+dfsg-1+deb10u4.

We recommend that you upgrade your zabbix packages.

For the detailed security status of zabbix please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/zabbix

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: PGP signature

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

7.8 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

39.1%